There has been a dramatic increase in reliance upon service providers accessible via electronic data communications networks such as the Internet. Such service providers are generally interested in providing access to the widest possible client audience at the lowest cost. Very recently, a number of solutions have emerged that allow service providers to achieve these goals. In particular, there has been very rapid growth in the use of the standardized hypertext capabilities of the World Wide Web (WWW) on the Internet. The standardized nature of the WWW, as well as the very low costs involved in accessing the Internet, have eliminated many of the previous hurdles to service development and distribution.
While the Internet's World Wide Web and other similar environments allow service providers to build systems that can efficiently deliver information to potentially large numbers of clients, they also impose limitations. These limitations are a direct consequence of the desire to provide a simple, generic processing model for multiple purposes.
It has been recognized that these limitations can be addressed to some degree by allowing servers to send executable code to clients, for execution by the clients themselves. This allows a server to build client software for a specific purpose, thereby allowing the service provider to add functionality to existing client software. An advantage of this approach is that it can in many cases reduce both the processing burdens on the server and the communications requirements between the server and the client.
While it might be very desirable for a client to execute server-provided software, the potential threat to security is a serious drawback. For a client to be willing to execute server-defined functionality, the client must be assured that no adverse effects will occur. Specifically, there must be a guarantee that existing client data will not be read or modified and that hostile code (viruses, Trojan horses, etc.) will not be generated and installed on the client system.
This is particularly problematic in the public network environment since mechanisms for establishing trust between a client and server are not widely deployed, and data communications channels are open to eavesdropping and tampering. Because of this, general purpose compiled programming languages are not a solution. It is inherently unsafe in a public network environment for a client to accept binary executable images from a server and execute them. Since the server-provided programs would have access to the full resources of the client computer environment, they could potentially perform any of various different types of dangerous or hostile operations.
Binary executable code also has the disadvantage of being architecture-specific. It is a significant complication for the server to determine the computer hardware in use by the client and the operating system, and to provide different executable modules for use with different systems.
These issues lead naturally to consideration of an interpreted language. This approach allows a server to create program scripts that can be executed on the client to extend its functionality, while providing a more controlled execution environment and architecture neutrality. Interpreters can be implemented on a variety of computer platforms and operating systems to provide an isolation layer between the language specification and the underlying architecture. Hence, a server can provide scripts for extensions that are executable on a variety of client machines. Interpreters can also perform runtime checking of various sorts to enforce access of specific resources and to detect when scripts have been tampered with. Sun Microsystem's recently announced Java language is an example of this approach.
From a client's perspective, the optimal situation is one in which it needs only trust the interpreter. Once a client has an interpreter from a trusted source, the client should be able to execute any script with complete safety. This is where existing approaches fail. Java, for example, is a general purpose programming environment which allows the generation of complex applications including I/O operations. Java is specifically designed to allow easy access to network facilities, hence it has the potential to surreptitiously transmit client confidential information; destroy client data, and perform other hostile actions. The protection against such behavior relies on the ability to validate Java scripts and determine their authenticity. Importantly, however, Java and many other systems rely on a trust relationship between the server and the client as the basis for their safety. We believe that this is a significant limitation which our invention addresses.
In addition to eliminating the requirement of a trust relationship between the client and server, our invention provides for situations in which a client may wish to execute server-provided code that performs I/O and other potentially dangerous operations. Our invention provides a secure extension mechanism that enables servers to download general purpose executables with full client validation of their origin and authenticity.